The health system has confirmed 1.8 million to federal regulators, and an extortion group is now publishing material it says proves a figure nearly seven times higher.

 

What happened

A data extortion operation calling itself LeakNet says it holds an 11TB archive taken from NYC Health + Hospitals containing information on more than 12 million people, Hackread reported on July 30, 2026. The group published a preview on July 27 with screenshots of databases, medical spreadsheets, internal messages, and a directory listing for the full archive, threatening to release the rest later. Samples reviewed by Hackread showed patient names, addresses, telephone numbers, Social Security numbers, and dates of birth, along with images appearing to show mental health diagnoses, HIV records, cancer appointments, and fingerprint documents carrying the health system's branding. Neither the health system, regulators, nor any independent forensic review has confirmed the 12 million figure. NYC Health + Hospitals has not publicly addressed the July 27 post.

 

Going deeper

What the health system has confirmed differs sharply from what LeakNet claims. NYC Health + Hospitals detected suspicious network activity on February 2, 2026, and its investigation determined that an unauthorized party had access from approximately November 25, 2025, through February 11, 2026, copying files for nearly three months. The health system reported 1.8 million affected individuals to the Department of Health and Human Services, and said in its public notice that exposed information varied by person and could include medical, insurance, biometric, billing and payment data, Social Security numbers, government identification, financial information, and online account credentials. The incident appeared to originate at an unnamed third-party vendor.

 

What was said

"Cybersecurity threats are one of the most significant risks currently affecting the health care system," wrote Bill Cassidy, chairman of the Senate Committee on Health, Education, Labor, and Pensions, in a June 4, 2026 letter to NYC Health + Hospitals Chief Executive Officer Mitchell Katz, copied to New York City Mayor Zohran Mamdani. Cassidy noted the health system serves over one million patients each year and listed the categories it had disclosed, including biometric information and precise geolocation data alongside health insurance and medical records.

 

In the know

LeakNet has been operating since November 2024, presenting itself as a "digital watchdog" concerned with internet freedom and transparency while running a conventional ransomware and extortion business, according to The Hacker News. Researchers tracking the group in March 2026 found it breaking into organizations through ClickFix, a technique that plants fake CAPTCHA verification prompts on legitimate websites the attackers have compromised, then instructs visitors to paste a command into the Windows Run dialog. Building its own access that way removes the group's reliance on buying entry from other criminals and lowers what each victim costs it to acquire. Stolen files are staged in cloud storage buckets, where the outbound traffic resembles ordinary business activity rather than exfiltration. The group has not confined itself to healthcare, with researchers also recording it against industrial organizations.

 

The big picture

The gap between 1.8 million and 12 million may narrow, widen, or turn out to be an artifact of counting. Database rows can represent appointments, transactions, or repeat entries for the same patient, so a row total is not a headcount, and screenshots cannot establish where every file in an archive originated. Biometric information does not work like a Social Security number, since a person can be issued a new number and cannot be issued new fingerprints, which puts that category of exposure outside what credit monitoring addresses. Third-party involvement appeared in 32% of healthcare breaches in Verizon's 2026 Data Breach Investigations Report healthcare snapshot, which advises that security fundamentals be built into contracts with business associates and suppliers rather than applied only inside an organization's own walls.

 

FAQs

How do organizations defend against ClickFix?

Blocking or restricting the Windows Run dialog through group policy removes the step the technique depends on, and endpoint rules can alert when a scripting or installer process launches from it. Staff should also be told plainly that no legitimate website ever asks a visitor to copy a command and paste it into their computer to prove they are human.

 

What obligations does a covered entity have when new information emerges after notification?

If a review identifies additional affected individuals, the entity must notify them and update its report to HHS. Organizations typically state in their initial notice that they will update it if material new information is confirmed, which preserves the ability to revise without appearing to have concealed anything.

 

Does a Senate committee letter carry legal force?

No. Committee inquiry letters are not subpoenas and do not compel a response, though declining to answer carries political and reputational consequences and can precede formal oversight action. Recipients generally respond in writing within the requested window.

 

What can patients do when biometric data is exposed?

Treat any biometric-based authentication tied to that identifier as compromised, and enable additional verification factors wherever a service offers them. Watch for identity claims made in their name through account notifications and benefits statements, since the exposure surfaces as fraudulent use rather than as a new line of credit.

 

Should organizations download leaked archives to check their own exposure?

No. Downloading stolen data compounds the exposure for the individuals in it, may create legal risk for the downloading organization, and the files frequently carry malware. Organizations should work through their incident response counsel and, where relevant, law enforcement channels instead.